Q301--Intent to Sole Source - Reference Laboratory Testing Service
Draft - abbreviated Page 22 of 32 B.3 PERFORMANCE WORK STATEMENT Contractor shall provide all labor, supplies, equipment, maintenance, information technology, and supervision necessary to provide Reference Laboratory Testing Services to FHCC as described herein. Reference Laboratory Services include but are not limited to: specimen preparation and storage, transportation of clinical laboratory specimens and microbiology cultures to the testing laboratories; performance of analytical testing as defined by the Contractor s reference test manual; the reporting of analytical test results within the required timeframes defined by the FHCC; specimen processors, and consultative services as required. I. Specimen Preparation and Storage Contractor shall supply each Government facility with its commercial laboratory reference test manual (either hard copy or electronic) to ensure that the collection and storage of specimens are in accordance with Contractor s requirements. The FHCC will provide laboratory specimens properly prepared, identified and labeled for testing. B. Contractor shall provide at no additional charge an adequate supply of specimen collection materials necessary to collect and preserve specimens that are destined to the testing laboratories. These materials include those items that are dictated by and in compliance with the collection requirements of the commercial reference laboratory such as dry ice, stabilizing tablets, ice packets, etc. Contractor will be responsible for storing specimens in such a manner to ensure no loss of specimen or the integrity of the specimen during transport. C. Contractor may also be requested to assist with specimen preparation (special staining) for histopathology and surgical pathology requirements. D. The Contractor shall store the specimens a minimum of tee days after the test result is reported in the event that subsequent action is necessitated (i.e. problem solving and/or repeat testing). E. If a medico legal specimen is submitted, the contractor shall provide its own special forms and special handling procedures to maintain a valid chain-of-custody possession and develop the formal documentation necessary for that purpose. Contractor s testing personnel who performed the analysis may be required to provide court testimony. Contractor testimony shall be provided as required at no additional expense to the Government. Transportation Services Contractor shall provide reference laboratory testing courier services of primarily biomedical materials including patient specimens and microbiology cultures originating from the FHCC and destined to the contracted commercial reference laboratories. These items are classified as Hazard Materials Class 6, Division 6.2 and are defined in 49 CFR Part 173.134 as those materials that contain or could contain etiologic agents. Transportation shall be done in such a manner that the safety and integrity of the biomedical materials are maintained. Routine transportation services shall occur once per day from the Government facilities listed in Section B2. Specimen pick-up times will be mutually agreed upon between the FHCC and the contractor after contract award. The contracted commercial reference laboratory shall be responsible for complying with the most current version of the accreditation standards as it relates to the transport of specimens to ensure that all transport personnel are properly trained and that their competency is regularly assessed in the appropriate safety, packaging and environmental control procedures suitable to specimen type and distances transported. This also includes issues such as adherences to regulations for transport of biohazards, use of rigid containers where appropriate, temperature control, notification procedures in case of accident or spills, etc. During the term of this contract, this contractor program may need to be updated or revised to comply with regulatory requirements. This documentation should be made available to the FHCC upon their request. Contractor shall provide, at no additional cost, all necessary supplies for biomedical materials necessary to distribute, transport, and deliver specimens from the FHCC to the testing laboratories. These supplies shall include, but are not be limited to: Shipping and packaging containers and/or bags. Packing material must be capable of maintaining temperature requirements for specimens until they reach the testing laboratories. Required labels/stickers and packaging materials for shipping specimens via courier for testing, which are infectious or etiologic agents, in accordance with appropriate requirements of 42 CFR Part 72, 49 CFR Parts 171 and 173, and the Dangerous Goods Regulations of the International Air Transport Association (IATA) consistent with current regulatory updates. Preprinted test request forms with the appropriate Shipping Section details and account information. Test request forms for specialized testing (i.e. cytogenetics, tissue, etc.). E. Upon each pick-up or delivery of testing specimens by the contractor, a shipping manifest shall be provided detailing specimen identification, source and destination information. In addition, it shall be the responsibility of the contractor to ensure that its or any subcontracted transport personnel shall comply with all policies and procedures for tracking specimens. Site-specific handling procedures will be mutually agreed upon between the FHCC and the contractor and will include, but is not limited to, documentation of dispatch and receipt of specimens, condition of specimens upon receipt, etc. F. Emergency transportation services shall be equal in quality to the routine transportation services provided, and be available 24 hours per day, seven days per week including federal holidays. The estimated number of emergency transportation services per year is one. Specimen pick-up response times for emergency transportation service requests shall be within 4 hours. III. Specimen Testing The contractor and/or subcontractor shall provide the full range of clinical and anatomic pathology diagnostic testing capabilities to execute all required tests as annotated in Attachment A (approximately 735 tests). Contractor shall make available the test information below and notify the FHCC when any modifications to this information occur during the contract period. Requisition form requirements Alphabetized test name list Contractor Test order code Specimen collection and preservation requirements Test method employed (indicate if testing performed in duplicate) and interpretations Test reference intervals adjusted for age, sex or race, when required Test specific sensitivity, specificity and interferences, when required Result code Test critical values, if any Policy for critical value notification CPT coding for test Contractor test turnaround times (minimum and maximum times indicated); where the turnaround time is defined as the time between receipt of specimen by the Contractor and receipt of results by the FHCC. Schedule of test performance (specific days of week/frequency indicated) Location of test performance by test name (i.e. name of primary laboratory, name of separate branch/division of primary lab, name and address of secondary (sub-contracted) laboratory must be cited) B. Contractor shall provide accurate, timely, and appropriate testing of patient specimens as requested by the FHCC. For most tests, the required test result turnaround time (TAT), is within 24 hours following specimen pick up either by hard copy or electronic report transmission. It is recognized that certain test procedures will require a longer turnaround time than the 24 hours. Under these circumstances, test results shall be delivered no later than 1 hour after the verification of the test result. C. The FHCC has identified several tests that require strict compliance to different, faster TAT timeframes when sent from the FHCC Red Rover Laboratory. These tests and applicable TATs are identified below. Test Name Required Turnaround Time Hepatitis A Ab Total Next business day from collection date by 1330 Hepatitis B Surface Ab QN Next business day from collection date by 1330 Measles (Rubeola) IGG Next business day from collection date by 1330 Rubella IGG Next business day from collection date by 1330 Varicella IGG Next business day from collection date by 1330 Mumps IGG Next business day from collection date by 1330 Sickle Cell Screen Next business day from collection date by 1330 Hemoglobin & Hematocrit Next business day from collection date by 1300 G6PD Deficiency Screen Next business day from collection date by 1330 Fasting Glucose Next business day from collection date by 1330 B-HCG Quantitative Next business day from collection date by 1330 ABO and Rh Next business day from collection date by 1330 Hemoglobin A1C Next business day from collection date by 1330 Syphilis Antibody Cascading Reflex Two business days from collection date by 1330 Gonorrhea PCR Two business days from collection date by 1330 Chlamydia PCR Two business days from collection date by 1330 Urinalysis Two business days from collection date by 1330 Urinalysis Microscopic Two business days from collection date by 1330 Hemoglobinopathy Two business days from collection date by 1330 Tuberculosis Test (must be 1 tube method) Two business days from collection date by 1330 D. The FHCC has identified several tests that require strict compliance to different, faster TAT timeframes when sent from the FHCC Main Laboratory. These tests and applicable TATs are identified below. Immunohistochemistry and Special Stains (Anatomic pathology) Not to exceed 3 business days from pick-up date and delivery date. Must be notified of all delays. Paps and HPVs Not to exceed 5 business days from pick-up date. Must be notified of all delays. Urine Cultures Not to exceed 3 business days from pick-up date and delivery date. Must be notified of all delays. E. All reference laboratory testing shall be executed in accordance with standard industry practices. It is preferred that test methods are FDA approved. Any non-FDA approved method being performed shall have a disclaimer and documented validation plan. Upon request, the validation plan and validation results shall be made available to the COR or designee. F. Contractor shall notify the COR and FHCC Laboratory personnel of any test information/methodology changes no later than two weeks prior to the implementation date of the test change. If any of these changes affect availability (i.e. discontinued) of the test, price or other information on Attachment A, the Contracting Officer shall also be notified. These changes shall be reflected via contract modification. Any increases in test price must be negotiated and/or approved by the Contracting Officer via contract modification. IV. Specimen Retention A medico legal specimen shall be retained indefinitely. This type of specimen will be identified by the Government in writing or tough telephone communication. All anatomic pathology materials (e.g., histology blocks, slides or other diagnostic material) generated by the VA and sent to the Contractor laboratory for staining, testing and diagnostic evaluation shall be returned within 5 days after final diagnosis is reported. Slides and blocks sent for immunohistochemistry and special stains should be sent back the same day as the stained slides. V. Reporting of Test Results The primary transmission of laboratory test results shall be tough electronic host to host computer interface. Laboratory test results that are not interfaced must be immediately available tough the Contractor s electronic web-based portal that the Government facility has access to. In unusual circumstances where electronic delivery either via interface or web-portal is not possible, the Contractor shall deliver the reports without an additional charge by expedited overnight courier shipping, mailing and/or transportation services by hand within 24 hours, or by telephone facsimile to a protected machine identified to the Contractor by the FHCC. Delivery by electronic mail i.e. MS Outlook, etc. is prohibited. Additionally, any test result that includes a pathologist interpretation must be transmitted to a dedicated fax machine at the ordering FHCC facility and when possible, available electronically via an online portal. Specifications outlining the requirements of the computer system interfaces including computer hardware, maintenance and supply requirements are defined in Section B3.X., Telecommunication Requirements below. Each test report generated in printed form or tough electronic transmission shall, at minimum, include the following information: Patient's full name Patient s identification number, e.g. social security number (SSN) Physician s name (if provided) FHCC medical record number or laboratory accession number (if provided) FHCC ordering facility name FHCC Account number Test(s) ordered Date/time of specimen collection (when available) Date/time test completed Test result Reference intervals (adjusted for age, sex or race, when appropriate) Toxic and therapeutic ranges (if applicable) Flagged abnormal results Reference laboratory accession umber Name and address of testing laboratory Any other information the laboratory has that may indicate a questionable validity of test results. Specimen inadequacy (if applicable) with documentation to support its unsuitability for testing. Test results determined by the contractor to be a critical value, as well as test results determined by the Illinois Department of Public Health to be Reportable Diseases, shall be communicated by telephone to a designated FHCC contact person(s) at the originating Government laboratory facility upon verification of the critical test result. The telephonic report shall be followed by an electronic report transmission. Contractor shall provide a daily report by 1:00 p.m. listing all incomplete specimens and canceled tests from the Red Rover account. VI. Specimen Processors Contractor shall provide two (2) full-time equivalent Specimen Processing Technicians to the FHCC (one assigned to Red Rover and one assigned to the Main Campus) laboratories to assist with the processing of specimens, e.g. centrifuging, packaging, shipping, ordering, etc. The technician shall also be responsible for retrieving laboratory results, obtaining test information, contacting customer service to obtain results and resolve inquiries, running and reconciling incomplete test lists. Specimen processors will not have access to any FHCC computer systems. The specimen processing technicians will work Monday tough Friday, excluding federal holidaysfrom 6:00 a.m. 2:30 p.m. for Red Rover Laboratory and 7:00 a.m. 3:30 p.m. for the Main Campus Laboratory. Lunch breaks will be a half-hour in duration. No overtime is anticipated or approved under this contract. B. Contractor shall provide enough back-up personnel to perform services during absences of the primary Specimen Processing Technicians for any reason. Contractor shall also provide for the permanent replacement of a primary Specimen Processing Technicians, if necessary. D. The Government will provide a work area to be used for administrative functions by the Contractor s employees (Specimen Processing Technicians). E. All contract employees performing work on a government facility shall observe and comply with all local rules and regulations prescribed by the installation and other federal authorities concerning fire, safety, sanitation, security and possession of firearms or other lethal weapons. No contract employee will be permitted on the installation when his/her presence could be detrimental to the security of the installation or safety to themselves. Specimen processors working on-site at the FHCC shall be subject to an ANACI background investigation. F. Contractor shall obtain all local, state and federal government licenses, passes and permits necessary to enter the government installation, to include motor vehicle registration and insurance, as required by the FHCC. VII. Customer Service Contractor shall provide toll-free telephonic customer service 24 hours per day, 7 days per week to assist Government staff with tracking and resolving related issues/problems that may arise in the performance under this contract. Upon award, contractor shall assign a local area account representative and alternate representative to provide direct and on-site support for each of the FHCC facilities. Contractor shall provide the name(s) and telephone number(s) of these representatives and other contractor employees who will address the following customer services toughout the contract performance period: 1. Telephone Inquiries Telephone inquiries are divided into four major categories with additional subcategories defining the type of inquiry and the Government s minimum time expectation for meeting this service. Specimen Collection Routine inquiries, questions and clarifications regarding collection requirements shall be addressed at the time of the initial call. Esoteric inquiries, questions and clarifications regarding collection requirements that require further research shall be addressed within A hour of the initial call. Testing Inquiries regarding the status of pending results shall be addressed at the time of the initial call. Esoteric inquiries when information is requested regarding methodology, correlation, interferences, reflex tests, etc. shall be addressed within two business hours of the initial call. c. Technical Expertise Test utilization inquiries where information is required as to the most appropriate test to be ordered shall be addressed within two business hours of initial call. Result interpretation inquiries shall be addressed within four business hours of initial call. 3) Consultative services where information is required regarding the clinical significance of tests shall be addressed within twenty-four business hours of the initial call. d. Account follow-up Information general in nature yet specific to the account, e.g. test pricing, equipment repair, supply ordering, etc. shall be addressed within four hours of the initial call. The Contractor shall notify the originating laboratory by telephone of specimens cancelled due to unacceptability for reasons relating to volume, specimen container, identification, loss of specimen, etc. VIII. Consultative Services/Reports Contractor shall provide consultative services that are consistent with the services offered to other contracted customers without compensation. These services may include consultations by laboratory professionals or experienced physicians on test or methodology selection or test result interpretation. Upon request, contractor shall provide a statistical analysis of the FHCC facility s workload testing volumes to assist in the monitoring of ordering trends and utilization patterns and will make recommendations to the FHCC on mechanisms to reduce its costs. C. The following reports may be requested by FHCC and shall be delivered to the FHCC by the 20th of the month following the close of the reporting month: 1) A monthly cumulative summary alphabetically by patient indicating patient s name, test ordered, date specimen received and ordering physician. 2) A monthly summary sheet by test frequency for each FHCC Laboratory listing patient name, volume of tests ordered, unit charge, total charges for this month and year to date. 3) A summary sheet listing the type and volume of testing sent to a subcontracted reference laboratory. 4) A monthly summary sheet by dollar volume listing tests in descending order of dollar volume with volume of tests ordered, unit charge for each test, total charges for months and year to date. 5) A utilization summary sheet by test frequency of both FHCC Laboratories listing all tests ordered, the volume of tests ordered, unit charge per tests, total charges and percent abnormal results for the period. 6) A monthly summary sheet of all telephone notifications of specimens cancelled because of unacceptability, i.e. volume, specimen container, identification, loss of specimen, etc. D. Contractor shall provide a cumulative workload summary report of tests performed on a monthly basis. The summary must include the facility account number, the test name, the test ordering code, monthly test volume, year-to-date test volume, unit test cost, monthly test expenditures and year-to date test expenditures. A copy of the report shall be delivered electronically to the Contracting Officer and COR by the 20th of the month following the close of the reporting month. E. All reports shall be submitted in an electronic spreadsheet format and have the capability to sort by four (4) different methods: 1) Facility account number 2) Test names listed alphabetically 3) Test names listed in order of year-to-date test frequency (highest to lowest) 4) Test names listed in order of year-to-date total test cost (highest to lowest) G. The Contractor shall provide, a daily cumulative report retrievable by collection date(s) that details patient identifying demographics and the associated test results for the Red Rover Laboratory as identified in B.3.III.C. Designated government contact personnel must be notified when it s available. The daily report shall be available prior to the turnaround time deadline. IX. Data Management System A. Contractor shall provide to the FHCC all necessary laboratory test parameters (parameters are required for each test contained in a panel) to ensure accurate test result transmission between the FHCC s and the Contractor s databases. Required test parameters are listed below. Ordering code Logical Observations Identifiers Names and Codes (LOINC) code CPT code(s) Interface code Test cost Reference ranges Units of measurement Test result interpretation or interpretive remarks, if appropriate Testing site (if not performed at the contractor s main laboratory facility Test methodology Specimen types Specimen collection and handling requirements Indication whether test is a panel/profile test, list of tests included in panel/profile If test is a panel or profile test, list the tests included (NOTE: the above parameters are required for each test contained in a panel). The parameters for all tests in the contractor s database shall be kept current and be available to the FHCC toughout the performance period of the contract. Updates to test parameter information must be provided to FHCC no less than 2 weeks prior to the implementation of any changes in the following situations: when new tests are developed and introduced into the contractor s test menu, testing parameters have changes or when tests are discontinued or replaced by other tests. The Contractor shall provide telephone access to a technical representative to respond to any question(s) regarding the laboratory test parameter information. B. The Contractor shall provide a data management system that meets the following requirements: Test ordering must be accomplished tough a menu that is intuitive, has minimal options and uses a mouse or touch screen. Upon selection of the test, the computer shall alert (flag) the user to the type of specimen required and the storage conditions. It must also alert the user to the location of the laboratory that will be performing the test. Test definition, test information and test requirements must be complete, available and easily accessible. 3) Accepts FHCC generated shipping manifests that identify specimens sent to the contractor s testing laboratories, transportation conditions, and testing ordered. 4) The status and the results of testing must be available within published timeframes and easily retrievable by various methodologies. At a minimum, these options must include sort by patient name; sort by date; sort by test; and sort by incomplete test. Incomplete tests must have an indication of the pending time until completion. Alert messages, or other notifications, must be generated when testing is delayed beyond required and/or published timeframes. 5) FHCC must be able to print test results from the contractor s web-based portal as well as reprint previous test results. Telecommunication Interface Requirements A. The contractor shall provide an integrated system approach to facilitate and streamline all aspects of specimen testing. All reasonable effort shall be made to improve services, reduce cost to the FHCC, and implement methods that reduce or eliminate manual procedural steps such as bar-coding and specimen labeling. The contractor shall also provide a bi-directional interface system to electronically transmit orders, specimen status and test results between its computer system and the two computer systems at the FHCC (VA VistA and DoD CHCS). All test panels and individual tests must be mapped in both the VistA and CHCS systems. As such, this contract will require an approved Business Partner Gateway (BPG) Interconnection Security Agreement (ISA) and Memorandum of Understanding (MOU) for interface with VistA, as well as laboratory interoperability with the CHCS laboratory information system tough an approved DoD methodology on a Military Health Systems Medical network. B. Contractor shall provide, install, maintain, repair, and remove if necessary, all required telecommunication equipment, hardware, software and related consumable supplies to support the transmission of electronic data to the FHCC Laboratories. This may include, but is not limited to: 1) Generic Instrument Manager (GIM) for host to host connectivity 2) Any required lease communication lines 3) Software to receive and send orders, status and test results 4) Shipping list printers 5) Back-up result printers connected directly to Vendor s computer system 6) Consumable supplies to maintain the operation of the equipment listed above, e.g. toner, etc. Contractor shall be responsible for all annual recurring costs associated with programming, support and maintenance of any GIM system(s) including all GIM equipment, software and instrument connections, and the expense of the electronic message connectivity during performance of the contract. The GIM(s) will be located in a FHCC secured area. The vendor shall have access to the GIM(s) during normal FHCC business hours if prior arrangements have been made, unless special circumstances exist. Contractor shall coordinate with the respective FHCC Information Technology Department for access to the GIM(s). F. Contractor shall provide FHCC with specimen status in response to electronic and verbal queries. Upon testing completion, a formatted Health Level 7 (HL7) message containing specimen results with FHCC s assigned specimen identification shall be returned to the requesting FHCC Laboratory. All electronic messaging between the contractor and FHCC host computer systems using a GIM shall utilize VistA Health Level Seven (HL7) technical specifications or any later version, and CHCS. HL7 is a registered trademark of Health Level Seven, Inc, and is a Standards Developing Organization accredited by the American National Standards Institute to author consensus-based standards. Information regarding HL7 transmission protocols may be accessed tough the Health Level Seven, Inc. web-site: www.HL7.org. G. In the event that electronic communication is disrupted, the vendor shall provide hard copy of specimen results upon demand. The hard copy must contain FHCC s assigned unique identification number that is associated with each individual specimen. This specimen identification number will appear on the test order form, on the specimen label and on the shipping manifest. H. Contractor shall address, within two hours of initial inquiry, interface connection questions where information is required to update, maintain and support the services of the host-to-host linkage between the FHCC and the Contractor. I. A A Interface with VistA (Veterans Integrated System Technology Architecture) or current system (VA tentatively is looking to roll out and have a new system completed by 2022): This connection is required for all samples sent from the FHCC Main Campus Laboratory. 1) Contractor shall develop and program an interface connection to electronically transmit orders, specimen status, and test results between the Contractor s host computer system and FHCC s host computer system, VistA. To do this, it is preferred the contractor have a current VA nationally approved Business Partner Gateway (BPG) Interconnection Security Agreement (ISA) and Memorandum of Understanding (MOU); but the agreements and memorandums identified above may also be established directly with the FHCC. These typically take 30 to 45 days to establish.A 2) VistA supports the Universal Interface (UI) and the GIM. The GIM is a commercial hardware and software product that provides electronic connection between instruments and the VistA host computer, as well as connectivity between the VistA computer host and the contractor s host computer. VistA provides a single serial communication line to the GIM for passing electronic data. This configuration provides the required security of the FHCC VistA host computer system. The actual electronic connection between the GIM and the contractor s host system is of the contractor s choosing. If contractor utilizes a third-party instrument manager system to handle HL7 order and result messages between the contractor s host computer system and VistA, then the contractor will be responsible to initially add all applicable test codes and names of the top 125 most frequently ordered tests.A 3) The transmission protocol shall conform to current VistA Health Level Seven (HL7) and Laboratory s HL7 technical specifications. VistA Laboratory Electronic Data Interchange (LEDI) will provide technical specification for message format, content and encoding tables and HL7 message protocol conventions. The LEDI specification follows very closely to the current HL7 standards. The LEDI specification can be negotiated at the technical level only. 4) VistA LEDI will provide to the contractor shipping lists containing required specimen demographics and requested tests to be performed. This information will be provided in printed format during the implementation period and is also available in electronic HL7 format if required. If the contractor requires of the FHCC any specific software to implement the electronic interface, these requirements must be specified in the offer to the Government. VistA LEDI software will also provide a HL7 acknowledgement for the receipt of tests results from the contractor. J. Interface with CHCS (Composite Health Care System):A This connection is required for all samples that are sent from Red Rover Laboratory and Fisher Laboratory. 1) Contractor shall develop and program an interface connection to electronically transmit orders, specimen status, and test results between the Contractor s host computer system and the FHCC s host computer system, CHCS.A A To do this, it is preferred the contractor have a current Authority to Operate (ATO) Certification from the Department of Defense (DoD) or past experience with connection to DoD information systems, but new ATO Certifications may be established. 2) Contractor shall follow the DoD Instruction (DoDI) 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT) to ensure its system will achieve and maintain adequate security for all unclassified DoD information on non-DoD Information Systems (IS), and work with FHCC COR in coordination with the FHCC/DoD RMF and IS/IT teams to ensure this requirement is met. The Contractor shall coordinate with the Government to ensure that the appropriate security and privacy controls have been identified. Contractor will address how applicable safeguards will be implemented prior to commencement of full performance. 3) Contractor shall ensure all necessary preparations, including ability to electronically transfer data correctly, are performed for full contract services prior to contract performance/effective date. Upon award of contract, the contractor will have six (6) months to achieve full testing performance of the top 125 highest volume tests. Failure to achieve an ATO Certification, at least on a conditional basis, within 3 months of contract award during the ramp-up period may be considered non-fulfillment of the contract. Contractor shall ensure the following tasks identified in the ramp-up period are performed: a) An ATO process kick-off shall be initiated between the Contractor, FHCC COR and DoD RMF Assigned Team. Contractor shall contact the DoD RMF Office Representative and FHCC COR, no later than five (5) business days after contract award to start the process. Failure to do so would be considered a contractor-caused delay. Thereafter, the contractor must attend a monthly teleconference to discuss and provide a progress report on/around the 5th of each month, between the FHCC COR, RMF Team, and the Contractor. The report and discussion will include progress and issues on the efforts to achieve the required electronic interface in accordance with DoDI 8510.01. Teleconferences shall continue until the interface is complete. b) Contract personnel needing privileged-level account for administrative/maintenance support of systems/applications on the network, will meet DoD requirements for a privileged-level account before being provided access to DoD systems (see B.5.XVI). Contractors must also undergo a successful security screening and background investigation prior to access being granted. XI. Test Database Build & Validation A. Establishing the test databases and validation process is significant task in the performance of the contract. Meeting the below specified deadlines are of utmost importance to the FHCC. As such, Contractor shall have operational interface connections with the FHCC Main Campus Laboratory within 45 days after contract award and with the FHCC Red Rover and Fisher Laboratories within 90 days after contract award. The establishment of the test database will be the responsibility of the FHCC and will begin as soon as the Contractor notifies the Government of an operational interface connection. The validation of electronic transmission of orders to the contractor and receipt of electronic result messages from the contractor to VistA and CHCS systems tough the interface will be the joint responsibility of the FHCC and Contractor. B. Test database construction and transmission validation will occur using a phased approach that occurs over the periods of time listed in the table below. Regular laboratory testing services of the top 125 highest volume tests under this contract must begin no later than 180 calendar days after contract award Identification of specific test names for each phase will be provided after contract award. Phase Top # of Tests w/Highest Volumes Test Transmission Validation Time Periods After Interface Connection 1 1-125 1-90 days after interface connection 2 126 475 91 days - 6 months after interface connection 3 476 and above As needed tough life of contract C. The Contractor shall certify in writing successful test validation by the final day of the time periods indicated for Phase 1 and Phase 2 listed above. Written certification will not be required for Phase 3, as test establishment and validation will occur on an individual, as needed basis. B.4 SPECIAL CONTRACT REQUIREMENTS Term of Contract This contract is effective for a one (1) year period with a one (1) year option effective from the date of award. IV. Qualifications/Requirements of Laboratory & Contractor Personnel A. Laboratory 1) The contractor must be actively engaged in providing the specific services and laboratory testing identified herein. Contractor must have at least tee years of experience in providing laboratory testing services and must have at least one-year experience in transporting biomedical materials. 2) Offerors, including subcontractor(s), must continuously hold a Certificate of Compliance or Certificate of Accreditation from the Centers for Medicare & Medicaid Services as meeting the requirements of the Clinical Laboratory Improvement Amendments of 1988 or must demonstrate accreditation by a regulatory agency(s) with deemed status from the Centers for Medicare & Medicaid Services, e.g. The College of American Pathologists, and/or other state regulatory agencies, as appropriate, and as mandated by federal and state statutes. The testing laboratories must maintain valid certifications during the entire performance period of this contract. 3) Copies of all relevant permits/licenses and certifications inclusive of any sanctions current or pending toughout the United States of America must be supplied in response to this solicitation. In addition, as these documents are reissued or re-awarded, the awarded Contractor must supply a copy to the CO and COR. The above documents must also be supplied for each testing laboratory that is a subcontractor of the primary contractor. 4) Contractor must notify immediately the COR in writing, upon its/any subcontractor s loss of any required certification, accreditation or licensure. Contractor shall maintain safety and health standards consistent with the requirements set forth by the Occupational, Health, and Safety Administration (OSHA), and the Center for Disease Control (CDC) and Prevention. The Government reserves the right to physically inspect the testing laboratories prior to a contract award and at any time during the contract period to ensure the testing laboratory s compliance with accreditation and quality assurance practices and requirements. The Government will not be liable for any expenses incurred by the contractor as a result of these inspections. B. Personnel 1) Contractor shall ensure all testing and supervisory personnel at all contractor-owned, affiliate, or subcontracted laboratories assigned to work under this contract meet and maintain the applicable personnel qualifications set forth under the Clinical Laboratory Improvement Amendments (CLIA) of 1988 regulations. 2) Contractor shall ensure its employees have the ability to perform the applicable duties consistent with their license and certification. Personnel assigned by the contractor to perform the services covered by this contract shall be proficient in written and spoken English (38 USC 7402). Contractor couriers entering any Government facility must be attired in a contractor-issued uniform that bears the name of the Contractor s company. In addition, all contractor representatives shall prominently display a contractor-issued identification badge. III. Medical Records Clinical or other medical records (i.e. test results) of FHCC veteran patients treated by Contractor under this contract are owned by the FHCC. If requested, test results will be mailed to the FHCC at no additional cost. Mail shall be sent in accordance with VA Directive 6609, Mailing of Sensitive Personal Information. If a subpoena or court order is received for the production of a medical record/test result, the contractor shall notify the Contracting Officer that a subpoena or court order was received. IV. Confidentiality of Patient Records A. The Contractor is a FHCC contractor and will assist in the provision of health care to patients seeking such care from or tough FHCC. As such, the Contractor is considered as being part of the Department health care activity. Contractor is considered to be a FHCC contractor for purposes of the Privacy Act, Title 5 U.S.C. 552a. Further, for the purpose of FHCC records access and patient confidentiality, Contractor is considered to be a FHCC contractor for the following provisions: Title 38 U.S.C. 5701, 5705, and 7332. Therefore, contractor may have access, as would other appropriate components of FHCC, to patient medical records including patient treatment records pertaining to drug and alcohol abuse, HIV, and sickle cell anemia, to the extent necessary to perform its contractual responsibilities. However, like other components of the Department, and not withstanding any other provisions of the contract, the contractor is restricted from making disclosures of FHCC records, or information contained in such records, to which it may have access, except to the extent that explicit disclosure authority from FHCC has been received or disclosure is required by law. The contractor is subject to the same penalties and liabilities for unauthorized disclosures of such records as FHCC. VI. Regulatory Standard All work under this contract shall be performed in accordance with all regulatory requirements for laboratory services such as those set forth by the Clinical Laboratory Improvement Amendments of 1988 (CLIA), as well as all other applicable laws and regulations. As the FHCC is a hospital setting, it is subject to inspections and accreditation by The Joint Commission. Contractor shall be aware of all laboratory standards required by The Joint Commission and, in the absence of a contradictory standard from another entity such as CLIA, all work under this contract shall be performed in accordance with those standards. A copy of these standards may be obtained from The Joint Commission, One Renaissance Blvd., Oakbrook Terrace, IL 60181. X. Prohibition of Contract Performance Outside of the United States The entire performance of the contract shall be within the borders of the United States of America, the District of Columbia and/or Puerto Rico. The Contractor shall not access any FHCC data/information (for example, by remote computer access) from locations that are outside the above-stated borders. Furthermore, the Contractor shall not send, transfer, mail or otherwise transmit any FHCC data/information to locations outside the above-stated borders. [End of Special Contract Requirements] B.5 CONTRACT SECURITY REQUIREMENTS I. General Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as FHCC and FHCC personnel regarding information and information system security. II. FHCC Contractor Personnel Security Requirements Failure to comply with the contractor personnel security requirements may result in termination of the contract for default. Contractor and its subcontractors shall have a current process in place for conducting employee screening/background checks as a condition of employment with the contractor or subcontractor. Contractor shall also provide a certification memo indicating that all its employees and subcontractor employees having access to VA and DOD sensitive information (i.e. laboratory technicians and/or technologists, administrative personnel) during the performance of this contract have successfully passed tough this process to their standards. The certification memo shall be provided to the Contracting Officer and COR on an annual basis (employee screening/background checks are not required to be re-conducted annually). All personnel who require access to the Department of Veterans Affairs' or Department of Defense computer systems at FHCC or have access to FHCC sensitive information shall be the subject of a background investigation. The FHCC obtains the Background Investigation tough the Electronic Questionnaires for Investigations Process (e-QIP). Upon receiving a request for the investigation from the Contracting Officer, the contractor s employee will be initiated into e-QIP for the Background Investigation followed by an e-mail with instructions to log into e-QIP. Contract employee shall complete all application requirements within 5 days of receipt of e-QIP email. A contractor s employee shall not commence working at the FHCC under contract until the Contracting Officer receives notification from the FHCC Office of Security and Law Enforcement that the contract employee s application was received complete. A favorable adjudication from the VA Office of Security and Law Enforcement must be received in order for a contractor employee to continue contract performance. A. Position Sensitivity - The position sensitivity has been designated as Low Risk. The positions under this contract are designated as Non-Critical Sensitive (NCS). B. Background Investigation - The level of background investigation commensurate with the required level of access at FHCC is Access National Agency Check with Written Inquiries (ANACI). III. REQUIREMENTS FOR REMOTE ACCESS The contractor may be allowed remote access to FHCC computer systems in the performance of the contract. FHCC has stringent policies and procedures covering remote computer access; therefore, the following responsibilities are outlined below. A. FHCC Responsibilities 1) FHCC will provide secure and reliable remote access to systems, applications, and information on the VA network to the contractor. 2) FHCC will provide firewall and antiviral software with updates to the contractor. 3) FHCC will provide security training to contractor s current employees and new employees as needed. 4) After contract award, FHCC reserves the right to inspect contractor s facilities, installations, operations, documentation, records and databases. B. Contractor Responsibilities 1) Contractor will ensure adequate LAN/Internet, data, information, and system security in accordance with FHCC standard operating procedures and contract terms and conditions. 2) Contractor shall install FHCC provided firewall and antiviral software on all networks and/or individual computers accessing FHCC networks. The Contractor is responsible for the installation and testing of all required patches to ensure the security of the system. 3) All remote connections to FHCC networks must be approved to use Office of Cyber and Information Security (OCIS) authorized configurations and access points. Contractor s remote access sessions tough the Internet or other networks must be conducted using FHCC s remote access Virtual Private Network (VPN) service. 4) Contractor will notify the assigned Information Security Officer and Contracting Officer immediately when their employee(s) no longer require access to FHCC computer systems. 5) Contractor will not publish or disclose in any manner details of any safeguards either designed or developed by the Contractor and/or subcontractors under this contract or otherwise provided by the FHCC without prior written approval by the Contracting Officer and the assigned Information Systems Security Officer (ISSO). 6) Contractor will require that employees sign FHCC National Rules of Behavior and VPN Rules of Behavior, follow FHCC guidelines. Contractor s own information technology and compliance programs require employees to create strong passwords, do not divulge or share access codes or passwords, safeguard all sensitive information, and follow all Contractor information security and privacy requirements. 7) The Contractor will notify the Contracting Officer in writing of any subcontractors performing work under this contract that will require remote access to FHCC computer systems. Contractors will be held responsible for their subcontractors. All subcontractors will be required to follow the same FHCC computer requirements as the prime contractor. 8) The Contractor will adhere to the remote access requirements, and ensure that systems are properly configured, and appropriate security mechanisms and monitoring devices are up to date with best practices and technical standards. 9) Contractor will report any security violations, suspected or attempted violations, and any unanticipated teats or hazards immediately to the assigned ISSO, CO, and the COR. VIII. FHCC SENSITIVE INFORMATION & DATA SECURITY REQUIREMENTS D. FHCC sensitive information and data may not be transmitted across the Internet unencrypted (including email and instant messaging) and must be protected by (VA-VPN) VA Virtual Private Network or FHCC approved encryption process (Example: PKI - Public Key Infrastructure). E. FHCC sensitive information may not reside on non-FHCC systems or devices unless specifically designated and approved as appropriate for the terms of the contract. All systems that store or process FHCC data will be protected with FHCC approved encryption (FIPS 140-2 compliant). F. Any security violations or suspected violations shall be immediately reported to the VA Contracting Officer and the FHCC Information Security Officer. XIII. SECURITY CONTROLS COMPLIANCE TESTING On a periodic basis, FHCC, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. Within 10 working-days, at the request of the government, and on a date acceptable to both parties, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein FHCC information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of FHCC, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by FHCC in the event of a security incident or at any other time. XV. DOD SYSTEM SECURITY REQUIREMENTS A. Contractor must meet FHCC Standards for any Medical Devices connected to the FHCC systems. B. Contractor agrees to comply with security regulations and guidance listed in Section B.5.XX. C. Government will provide templates of all requested technical documentation no later than 14 days from Date of Award. The Contractor shall remit all requested technical documents to the FHCC no later than 45 days from the Date of Award. D. Contractor shall provide a Point of Contact (POC) responsible for the cybersecurity of the contractor device or system, toughout the performance of the contract. Contractor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials. E. Contractor shall obtain a recommendation of a full Authorization to Operate (ATO) from a Government-appointed third-party validator within twelve (12) months of contract award for technologies processed tough an Assessment & Authorization (A&A). F. Contractor shall, after issuance of an ATO, ensure that the contractor s device or system maintains its ATO approval on its operating system platform and patches/updates for the life of the contract. G. The contractor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control. H. The contractor shall notify the FHCC COR and CO in writing with any inabilities to comply with FHCC security requirements. Contractor will provide anticipated costs and timelines required to address any vulnerabilities in question. XVI. PRIVILEGED USER TRAINING AND CERTIFICATION REQUIREMENTS A. If a contractor requires a Business-To-Business (B2B), access, etc. to government networks to maintain or analyze their system they must adhere to the following requirements. 1) The Contractor shall submit to the Government, sections of the B2B Gateway Questionnaire. 2) Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the DOD network will meet DOD requirements for a privileged-level account before being granted a network account. Requirements include: a) Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The only method for authenticating is the Common Access Card (CAC). b) IA Training as required. B. All Contractor systems that communicate with DoD systems shall interconnect tough the established MHS Virtual Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, contractors shall connect to a DISA-established Web Demilitarize Zone (DMZ). Approval of the conditional ATO must be completed within tee (3) months of contract award. Access to website systems should comply with DoD complexity guidelines for password access. C. Contractor shall follow DoD 6025.18-R, DoD Health Information Privacy Regulation. D. Contractor shall connect to the B2B gateway via a Contractor furnished Internet Service Provider (ISP) connection. Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. The contractor shall acquire and maintain the circuit to the B2B gateway and acquire a Virtual Private Network (VPN) device compatible with the MHS VPN device. E. Contractor shall comply with FHCC guidance regarding allowable ports, protocols and risk mitigation strategies and will provide, maintain and configure VPN concentrator that complies with DoD security standards. F. All costs for VPN hardware and software shall be incurred by the Contractor. G. Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative s responsibilities and required access to FHCC Sensitive Information (SI) as determined by the site Chief Information Officer. H. The Contractor shall validate that systems authenticate users tough the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the vendor s technical users will maintain secure logon. I. The Contractor shall provide all required information to support and initiate the Laboratory Information Management System accreditation efforts to remain compliant with all current accreditation needs and efforts. This shall include system-specific information presented in the style designated by current DoD regulations and policies. J. The Contractor shall provide information for the Risk Assessment to the Government for all networking IT applicability. XVII. ASSESSMENT AND AUTHORIZATION (A&A) A. Contractor shall provide hardware/software lists, architecture drawings, and workflow drawings within 10 business days after contract award. The contractor shall submit all other RMF-required documentation for review and approval, no later than forty-five (45) days after receipt of the templates provided by the Government. B. Contractor shall obtain approval from the Government for any contractor-developed RMF policies, plans, and procedures, prior to implementation. C. Contractor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of a request by the Government. D. Contractor shall provide technical scans within one (1) month of the A&A kickoff meeting. E. Contractor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted. F. Contractor shall ensure that their device or system supports the use of approved intrusion detection and prevention, antivirus, and anti-malware applications that are approved at the time of the ATO. The contractor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. DLP, IPS, Antivirus, etc.) without performance degradation of the contractor device or system. In cases where the operation of security applications are not technically achievable, the contractor shall provide detailed justification and a POA&M describing steps towards compliance with this requirement. G. The contractor shall ensure that the device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, and real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the contractor shall provide a detailed list of exclusions with justifications. XVIII. CYBERSECURITY REQUIREMENTS A. Reauthorization in accordance with DoD RMF requirements: Per DoDI 8510.01, Enclosure 6, para 2.f.(6).(a), In accordance with Appendix III of OMB Circular A-130, systems must be reassessed and reauthorized every 3 years or as a result of a system update that negatively affects the security posture (whichever is less). Program Offices or appropriate logistics organizations plan for this activity. The results of an annual cybersecurity review or a negative change to the system or environment at any time (i.e., a change increasing the residual risk) may result in a need for reauthorization prior to the regular tee-year reauthorization. B. The contractor shall maintain all systems provided pursuant to this contract, to include the supported operating system, by issuing patches/updates to mitigate vulnerabilities [e.g., Information Assurance Vulnerability Alerts (IAVA) or Information Assurance Vulnerability Bulletins (IAVB)] and network security configurations [e.g., Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs)]. The contractor must adhere to FHCC guidance for remediation or mitigation of vulnerabilities associated with the system. [End of Contract Security Requirements] VA69D-16-D-0087 Page 32 of 32
36C25221R0047 Department of Veterans Affairs Veterans Health Administration Veterans Integrated Service Network 12
1/6/21, 3:51 PM